{"schemaVersion":3,"id":"CVE-2017-11398","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions to perform authenticated requests on a vulnerable system.","dates":{"published":"2018-01-19T19:00:00.000Z","modified":"2024-08-05T18:05:30.602Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.8,"severity":"high","version":"3.0","versionLabel":"v3.0","source":"NVD","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.8,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.08195,"percentile":0.94833,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.08195},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.06218,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.08195,"percentile":0.94833}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.06218,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.08195,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.08195,"percentile":0.94833}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_BD644E795D3564C3","name":"Exploit Reference (coresecurity.com)","source":"reference","url":"https://www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilities","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"43388","name":"Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control","source":"exploit-database","url":"https://www.exploit-db.com/exploits/43388","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":"remote","platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"remote","platform":"multiple","file":"exploits/multiple/remote/43388.md","codes":["CVE-2017-14097","CVE-2017-14096","CVE-2017-14095","CVE-2017-14094","CVE-2017-11398"]},"metasploit":null}],"exploitCount":2,"weaknesses":[{"id":"CWE-285","name":"Improper Authorization","description":"The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/285.html"},{"id":"CWE-534","name":"DEPRECATED: Information Exposure Through Debug Log Files","description":"This entry has been deprecated because its abstraction was too low-level.  See CWE-532.","type":"weakness","status":"Deprecated","abstraction":"Variant","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/534.html"}],"affected":[{"vendor":"trend micro","product":"trend micro smart protection server (standalone)","name":"Trend Micro Smart Protection Server (Standalone)","label":"trend micro smart protection server (standalone)","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"3.0, 3.1, 3.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"3.0, 3.1, 3.2","eol":null,"hubHref":"/vendor/trend_micro/trend_micro_smart_protection_server_standalone"},{"vendor":"trendmicro","product":"smart_protection_server","name":"smart protection server","label":"smart_protection_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 3.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 3.2","eol":null,"hubHref":"/vendor/trendmicro/smart_protection_server"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.exploit-db.com/exploits/43388/","label":"www.exploit-db.com/exploits/43388/","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/102275","label":"www.securityfocus.com/bid/102275","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]},{"url":"https://success.trendmicro.com/solution/1118992","label":"success.trendmicro.com/solution/1118992","hostname":"success.trendmicro.com","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"https://www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilities","label":"www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilities","hostname":"www.coresecurity.com","tags":["X Refsource MISC","Exploit","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2018-01-19T19:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-05T18:05:30.602Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":47,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T16:34:53.682Z","stale":false,"partial":false}}